zhinianboke xianyu-auto-reply review approve trusting http permission methods on the server side
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
A vulnerability was determined in zhinianboke xianyu-auto-reply on Server. Affected by this vulnerability is an unknown functionality of the file /api/v1/payment/withdraw/review?action=approve. Executing a manipulation can lead to trusting http permission methods on the server side. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. This patch is called 19fc3282a1bb78a05c34945c088525d20e081cbd. It is best practice to apply a patch to resolve this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zhinianboke | xianyu-auto-reply | all versions | — | No fix listed | CNA |
- xianyu-auto-reply Vendorzhinianboke Affected all versions Fixed in — No fix listed CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zhinianboke:xianyu-auto-reply:*:*:*:*:*:*:*:* | — | — | zhinianboke |
- cpe:2.3:a:zhinianboke:xianyu-auto-reply:*:*:*:*:*:*:*:* Versions — — ·zhinianboke
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-15753
- 2026-10-03 Alias added: GHSA-3rf8-mgfc-9vfp
References
More zhinianboke vulnerabilities
- TI-2026-13252 zhinianboke xianyu-auto-reply Backend User Endpoint users authorization CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-15753 · CVE Program
- CVE-2026-15753 · NVD
- FIRST EPSS
- GHSA-3rf8-mgfc-9vfp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences